UNSO is not giving expected result

[Former Member]

Dear Team,

I'm running AC 8.2.1.143. I have UNSOed ChromeSetup.exe through this command:

C:\Program Files\McAfee\Solidcore>sadmin unso C:\Users\Administrator\Desktop\CromeSetup.exe

I restarted the machine and run the ls command and I can still see this "ChromeSetup.exe" in the LS report. Than means it's not getting UNSOed.

Is there I'm missing something?

Thx in advance your valuable time.

[ryadav1]

Hello @Former Member ,

Kindly Run Sadmin ls -lax C:\Users\Administrator\Desktop\CromeSetup.exe

From the output , check the status of the file whether it shows  SO or UNSO

Thank you ,

Rajesh

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[Former Member]

Thx @ryadav1  for your time!!

Here is the output:

C:\Program Files\McAfee\Solidcore>Sadmin ls -lax C:\Users\Administrator\Desktop\CromeSetup.exe
<?xml version="1.0" encoding="utf-8"?>
<solidifier xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespac
eSchemaLocation="solidifier.xsd">
<list-solidified time="1603533681249" >
<certs-list>
</certs-list>
</list-solidified>
</solidifier>

C:\Program Files\McAfee\Solidcore>Sadmin ls -lax CromeSetup.exe
<?xml version="1.0" encoding="utf-8"?>
<solidifier xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespac
eSchemaLocation="solidifier.xsd">
<list-solidified time="1603533742183" >
<certs-list>
</certs-list>
</list-solidified>
</solidifier>

Sorry for the delay in response.

[Former Member]

Dear Team,

If somebody can put forward any insight on this.

Your time will be appreciated!!

[BenEllis]

If you would like someone to look into. You can always open a case with support with your logs and we can look further into it.

https://docs.mcafee.com/bundle/application-change-control-8.3.x-product-guide-windows/page/GUID-755C...

How to determine if something is Solidified (on the whitelist)?

Run the following command to list solidified items:

Sadmin ls

• If it echoes the path and name, it is solidified.
• If not, not solidified.

Run the following command to list unsolidified items:

Sadmin lu

• If it echoes the path and name, it is unsolidified.
• If not, it is solidified.

[BenEllis]

So the question is what is the response with "sadmin ls <path/file>"

[Former Member]

Hi @BenEllis,

I can still see here the executable I unsoed.  Even though there was no error while firing the command "unso -v <Path\file>" and I can see the other unsoed file was enlisted with same name but with different path. That means my specified file supposed to be unsoed, but strangely I can still see it in LS.  

Thank you!!